Data Privacy

This statement sets out the ways in which we process and protect personal data that comes into our possession, and is made by The Local Shopping REIT plc (“the Company”) for itself and for its subsidiary operating companies. It is also made on behalf of our investment adviser, Principal Real Estate Limited, which processes personal data referred to in this notice on our behalf.

Under the applicable legislation, any person on whom personal data is held (a “data subject”) is entitled to be notified of:

The entities that control the personal data;

The data held, including the categories it falls into;

The purpose for which the personal information is processed, the legal basis for this and the length of time the personal data will be retained;

The other parties with whom the personal data is shared and the purpose of this;

Details of any transfer of the personal data overseas and the security measures implemented;

The source of the personal data, if other than the data subject;

The legal rights of a data subject.

Further details of the ways in which we deal with and protect personal data are set out below under various category headings. A summary of the provisions for and rights applying to all data subjects are set out following the information on individual categories. Specific data privacy notices are applicable to our tenants and to our shareholders. Copies of these are at Appendix 1 and Appendix 2 to this privacy notice.

DATA SUBJECT CATEGORIES

Website Visitors

Our website uses cookies to track website usage and maximise the efficiency of the website. Analysis on website visitors includes frequency, timing and length of visit and page preference, as well as identification of any search engine used.

Email Enquiries

If you contact us by email and you do not fall within any of the other categories referred to in this notice, then we will use any personal information contained in your email (including your email address) solely to deal with your enquiry. We will share any personal data contained in your enquiry with others only to the extent necessary to properly address the enquiry your enquiry.

For the most part, such data will have been supplied either directly by the data subject or via the data subject’s professional adviser, investment manager or broker. We may also obtain data from one or more of:

our Registrars;

our legal advisers;

our retained brokers and corporate finance advisors.

Unless otherwise agreed, we will use this data solely to address:

our obligations to the individual shareholder and to the Company as a whole;

the Company’s general statutory and other legal obligations.

In order to do so, we may share personal data with others, such as:

our registrars;

our legal advisers;

our retained brokers and corporate finance advisors;

Government departments and agencies, when required to do so.

To read our investor privacy notice in full go to Appendix 1 to this notice.

Tenants

We supply our tenants with a privacy notice regarding our use of their personal data, either directly or through our managing agents. A pro forma template of our tenant privacy notice is at Appendix 2 to this notice.

Complaints

We will use personal data contained in any complaint we receive exclusively to address the subject matter of the complaint and to correspond with those concerned. This may necessitate sharing personal data with other parties.

Data held in relation to complaints is subject to the same security measures as other personal data in our possession. Data related to complaints is stored in a secure environment and may only be accessed by our authorised personnel. We will retain personal information provided in relation to a complaint for two years following closure of the complaint, following which it will be destroyed.

Business Contacts

We maintain and process information, including personal data, on our professional contacts to further our operational management and business development. Typically, this information will include: name, email address, job title and contact details and is likely to have been supplied by the individual concerned or a person or entity authorised by that individual to do so.

We consider that business contact information is supplied to us on the basis that we will use it for the purposes for which it was supplied and to maintain contact for future relationship development and business opportunities.

In order to fulfil the requirements for which the information was supplied, we may need to disclose the information to a third-party processor (for example a solicitor if the information was supplied in connection with a property transaction). In some circumstances we may need to use the information supplied to carry out regulatory searches, such as money laundering checks.

Service Suppliers

We hold and process personal information relating to individuals who directly, or through their employer, supply services to us or to our clients. The delivery of such services may be procured by us or by our managing agents. Such information is typically limited to individual contact details and is collected and maintained to procure and administer services under legal agreements with our suppliers and to manage relationships with them.

We share this information with others in order to facilitate the service supply. This includes our agents and other service suppliers, as well as property occupiers.

PROVISIONS AND RIGHTS OF ALL DATA SUBJECTS

General

We will process personal information only where we have a lawful reason for doing so.

Our reasons for processing personal data will be either

(1) that the data subject has specifically consented to the processing; or

(2) that the processing is necessary:

for the establishment or performance of a legal agreement (such as a lease);

for our legitimate business interests (such as service delivery, business development or the establishment or exercise of a legal claim).

Although there are other lawful reasons for data processing laid down in the applicable legislation, those listed above are those that are most likely to apply to our activities. It is our policy only to process personal data for the purpose for which it was supplied to us.

We operate a range of information and communication systems to enable our business to operate efficiently, on which personal data may be stored and processed. These systems are subject to a high level of security and integrity. Our electronic data is stored on secure Cloud-based facilities. We also hold secure copies of our databases for back-up and business continuity purposes. Hard copy data is kept within our secure office and we do not allow uncontrolled paper copies of personal data to be removed from this environment.

Our policy is to retain personal data only for as long as there is a legitimate need to do so. Where our possession of personal data is in connection with a legal agreement or a claim, we will ordinarily hold the data for a minimum period of six years after the legal agreement or claim has been discharged. At the end of this period, we will review the necessity for retaining the personal data and items that no longer need to be retained will be destroyed. We will repeat this review on an annual basis whilst we retain any personal data.

Transfer of Personal Data outside the EEA and Switzerland

In the event that personal data is transferred to, and stored at, a destination outside the European Economic Area (“EEA”) and Switzerland a similar degree of protection will be afforded to it by ensuring at least one of the following safeguards is implemented:

The country has been deemed to provide an adequate level of protection for personal data by the European Commission.

The data transfer is subject to standard contractual clauses approved by the European Commission giving personal data the same protection it has in Europe.

The recipient is self-certified under the EU-U.S. or Swiss-U.S. Privacy Shield Framework which requires them to provide similar protection to personal data shared between Europe and the US.

Rights of Data Subjects

All data subjects have the rights set out below in connection with the retention and processing of their personal data.

i.The right to be informed of the way in which your data is used

Details of this are set out above, and will vary the category a data subject falls into.

ii.The right of access

A data subject has the right to make a request in writing to obtain a copy of the personal data we hold. If you wish to do so, contact us using the contact details at the end of this notice. This is not an absolute right. For example, the data security interests of other individuals may restrict your right of access. If you are entitled to receive a copy of the personal data we hold on you, we will provide a copy as soon as is practicable and, in any case, within one month of your request. Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.

iii.The right to rectification

A data subject may require us to rectify inaccurate personal data, to complete it where it is incomplete or to correct it where it is misleading as to any matter of fact.

If you wish to do so, contact us using the contact details at the end of this notice. We will make the required adjustments as soon as is practicable and, in any case, within one month of your request. If, on review, we are satisfied that the personal data is accurate, we will notify you of this and of your rights to refer the matter to the the Information Commissioner. Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.

iv.The right to erasure

A data subject may request that their personal data is erased (the “right to be forgotten”). This right arises when the personal data is no longer necessary for the purpose for which it was collected and processed. Where we hold personal data solely for the fulfillment of the legal agreement, this right will arise only when that agreement is fully discharged. In all cases where personal data relates to a legal agreement or claim, we will maintain the data for a minimum period of six years thereafter.

v.The right to restrict processing

A data subject may request the restriction of the processing of their personal data, where:

the data subject has contested the accuracy of their personal data; or

the data has been unlawfully processed; or

the personal data is no longer needed by the data processor, but the data subject needs the data processor to keep (but not process) the personal data in connection with a legal claim; or

the data subject has objected to the processing of their data.

vi.The right to data portability

A data subject has the right to require us to provide a copy of the personal data that

the data subject has supplied to us; and

which we process by automatic means,

to enable the data subject to reuse it for their own purposes.

We will respond to such requests by supplying the data in a commonly usable, structured form as soon as practicable and, in any case within one month of your request. If you request it, we will do our best to supply the data directly to another organisation that you authorise to receive it.

vii.The right to object

A data subject may object to the processing of their data where:

the basis for processing is the processor’s legitimate or performance of a task in the public interest, including profiling;

the processing is for direct marketing, including profiling;

the processing is for scientific/historical research and statistics.

We do not believe that any of these apply to our processing of your data. However, if you believe that to be the case, please contact us using the contact details at the end of this notice.

viii.Rights in relation to automated decision making and profiling

A data subject has the right to object where their data is being processed in a manner which involves:

automated decision making (i.e. without human involvement); including

profiling (automated processing to analyse or predict things about you – such as behaviour, health, personal preferences.

For the most part, the data we may hold on you has been supplied either directly by you or via your professional adviser, investment manager or broker. We may also obtain data from one or more of the other sources listed under 6, below.

3.The purpose for which we hold and process your personal data is exclusively to perform:

our obligations to you as a member of the Company and to the Company as a whole;

the Company’s general statutory and other legal obligations.

The data processing activities we conduct (some of which may be delegated) include:

the maintenance of the Company’s register of members;

the administration of share-related distributions, including dividends;

correspondence with and notifications to Government and regulatory bodies;

internal reporting on share register movements.

Your data is processed solely for the purposes arising from your membership of the Company. This includes supplying it to the third-party processors described under 4, below. As this purpose relates to the legal relationship between you and the Company, it does not require any further specific consent from you.

We operate a range of information and communication systems to enable our business to operate efficiently, on which your data may be stored and processed. These systems are subject to a high level of security and integrity. Data is stored on secure Cloud-based facilities. We also hold secure copies of our databases for back-up and business continuity purposes.

We will retain your data for as long as we have an ongoing legal relationship with you, including any period for which there are outstanding balances on your account, and for a period of six years after this in order to fulfil our statutory obligations. At the end of this period, we will review the necessity for retaining your personal data and all items that no longer need to be retained will be destroyed. We will repeat this review on an annual basis whilst we retain any of your personal data.

In each instance the amount of your personal data that is shared is the minimum needed to perform the necessary activity. These data processors will not use your information other than for the purpose for which we have supplied it to them, which is that set out under 3, above. They will not share your data with anyone else unless we instruct them to share it with others on the above list.

In some instances we may be obliged by law to publicly release information which includes your personal data (for example, regulatory announcements to the Stock Exchange).

5.We do not transfer or store your data outside of the European Economic Area or outside the control of UK or EU regulations.

6.Besides the personal data that you or your professional representatives have supplied to us, we may hold information on you obtained from the following sources:

the Company’s Registrars;

the Company’s retained legal advisers;

the Company’s retained brokers and corporate finance advisors.

7.Your rights as a data subject are set out below, together with our commentary on how we address your rights in each case.

a.The right to be informed

Details of the ways in which we collect and use your personal data are set out under items 1-6, above.

b.The right of access

You have the right to access the personal data we hold on you. If you wish to do so, please contact us using the contact details at the end of this notice. We will provide a copy of the personal data we hold as soon as is practicable and, in any case, within one month of your request. Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.

c.The right to rectification

You have the right to require us to rectify inaccurate personal data, to complete it where it is incomplete or to correct it where it is misleading as to any matter of fact.

If you wish to do so, please us using the contact details at the end of this notice. We will make the necessary adjustments as soon as is practicable and, in any case, within one month of your request. If, on review, we are satisfied that the personal data is accurate, we will notify you of this and of your rights to refer the matter to the the Information Commissioner. Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.

d.The right to erasure

You have the right to request that your personal data is erased (the “right to be forgotten”). This right arises when the personal data is no longer necessary for the purpose for which it was collected and processed. As we hold your personal data solely for the fulfillment of the lease or tenancy agreement between us, this right will arise only following the end of your lease or tenancy agreement and will be subject to the retention requirements set out in paragraph 3, above.

e.The right to restrict processing

You have the right to request that that we restrict the processing of your personal data in the following circumstances:

where you have contested the accuracy of your personal data;

where we have unlawfully processed your data;

where we no longer need your personal data, but you need us to keep (but not process) it in order to establish, exercise of defend a legal claim;

where you have objected to our processing of your data and we are considering whether we have overriding legitimate grounds for doing so.

f.The right to data portability

You have the right to require us to provide a copy of the personal data that (a) you have supplied to us and (b) which we process by automatic means, to enable you to reuse it for your own purposes. We will respond to such requested by supplying the data in a commonly usable, structured form as soon as practicable and, in any case within one month of your request. If you request it, we will do our best to supply the data directly to another organisation that you authorise to receive it.

g.The right to object

You have the right to object to the processing of your data where:

the basis for processing is the processor’s legitimate or performance of a task in the public interest, including profiling;

the processing is for direct marketing, including profiling;

the processing is for scientific/historical research and statistics.

We do not believe that any of these apply to our processing of your data. However, if you believe that to be the case, please contact us using the contact details at the end of this notice.

h.Rights in relation to automated decision making and profiling

You have the right to object if you believe that your data is being processed in a manner involving automated decision making and personal profiling. We do not undertake any such activities.

For further information on the rights of data subject, visit the website of the Information Commissioner’s Office: https://ico.org.uk

•Digital images, if the property subject to your tenancy has a visual security facility

For the most part, the data we hold on you has been supplied either directly by you or via your solicitor or other professional adviser. We may also obtain data from one or more of the other sources listed under 6, below.

3.The purpose for which we hold and process your personal data is exclusively to perform our obligations under your property occupancy agreement and the statutory and other legal obligations that arise from it. The data processing activities we conduct (some of which may be delegated) are:

•management of your rent account;

•administration of property maintenance and repair needs;

•management of the service charge (if any) or individual repair and maintenance contributions applicable to your lease;

•management of the property, including ensuring tenancy conditions are fulfilled;

Your data is processed solely for the purpose of administering your lease or tenancy agreement, including supplying it to the third-party processors described under 4, below. This purpose does not require any further specific consent from you.

We operate a range of information and communication systems to enable our business to operate efficiently, on which your data may be stored and processed. These systems are subject to a high level of security and integrity. Data is stored on secure Cloud-based facilities. We also hold secure copies of our databases for back-up and business continuity purposes.

We will retain your data for as long as we have an ongoing legal relationship with you, including any period for which there are outstanding balances on your account, and for a period of six years after this in order to fulfil our statutory obligations. At the end of this period, we will review the necessity for retaining your personal data and all items that no longer need to be retained will be destroyed. We will repeat this review on an annual basis whilst we retain any of your personal data.

In the event that we sell the property that is subject to your lease, and in order to provide continuity of the management of your lease, we will supply your data to the new owner.

In each instance the amount of your personal data that is shared is the minimum needed to perform the necessary activity. These data processors will not use your information other than for the purpose for which we have supplied it to them, which is that set out under 3, above. They will not share your data with anyone else unless we instruct them to share it with others on the above list.

5.We do not transfer or store your data outside of the European Economic Area or outside the control of UK or EU regulations.

6.Besides the personal data that you have supplied to us, we may hold information on you obtained from the following sources:

•prior landlords (for example, where we have purchased the property subject to your lease);

•credit rating agencies;

•your bank, where you have made payments by credit transfer;

•your credit card company, where you have made payments using your credit card;

•publicly available sources, such as the Land Registry.

7.Your rights as a data subject are set out below, together with our commentary on how we address your rights in each case.

a.The right to be informed

Details of the ways in which we collect and use your personal data are set out under items 1-6, above.

b.The right of access

You have the right to access the personal data we hold on you. We will provide a copy of the personal data we hold as soon as is practicable and, in any case, within one month of your request.

c.The right to rectification

You have the right to require us to rectify inaccurate personal data, to complete it where it is incomplete or to correct it where it is misleading as to any matter of fact.

IWe will make the necessary adjustments as soon as is practicable and, in any case, within one month of your request. If, on review, we are satisfied that the personal data is accurate, we will notify you of this and of your rights to refer the matter to the the Information Commissioner.

d.The right to erasure

You have the right to request that your personal data is erased (the “right to be forgotten”). This right arises when the personal data is no longer necessary for the purpose for which it was collected and processed. As we hold your personal data solely for the fulfillment of the lease or tenancy agreement between us, this right will arise only following the end of your lease or tenancy agreement and will be subject to the retention requirements set out in paragraph 3, above.

e.The right to restrict processing

You have the right to request that that we restrict the processing of your personal data in the following circumstances:

•where you have contested the accuracy of your personal data;

•where we have unlawfully processed your data;

•where we no longer need your personal data, but you need us to keep (but not process) it in order to establish, exercise of defend a legal claim;

•where you have objected to our processing of your data and we are considering whether we have overriding legitimate grounds for doing so.

f.The right to data portability

You have the right to require us to provide a copy of the personal data that (a) you have supplied to us and (b) which we process by automatic means, to enable you to reuse it for your own purposes. We will respond to such requested by supplying the data in a commonly usable, structured form as soon as practicable and, in any case within one month of your request. If you request it, we will do our best to supply the data directly to another organisation that you authorise to receive it.

g.The right to object

You have the right to object to the processing of your data where:

•the basis for processing is the processor’s legitimate or performance of a task in the public interest, including profiling;

•the processing is for direct marketing, including profiling;

•the processing is for scientific/historical research and statistics.

We do not believe that any of these apply to our processing of your data.

h.Rights in relation to automated decision making and profiling

You have the right to object if you believe that your data is being processed in a manner involving automated decision making and personal profiling. We do not undertake any such activities.

For further information on the rights of data subject, visit the website of the Information Commissioner’s Office: https://ico.org.uk

To exercise any of the data subject rights described above, contact our managing agent using the following individual contact details that have been supplied to you. Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.

For further information regarding the personal data we hold on you, contact:

·Digital images, if the property subject to your tenancy has a visual security facility

For the most part, the data we hold on you has been supplied either directly by you or via your solicitor or other professional adviser.We may also obtain data from one or more of the other sources listed under 6, below.

3.The purpose for which we hold and process your personal data is exclusively to perform our obligations under your property occupancy agreement and the statutory and other legal obligations that arise from it.The data processing activities we conduct (some of which may be delegated) are:

·management of your rent account;

·administration of property maintenance and repair needs;

·management of the service charge (if any) or individual repair and maintenance contributions applicable to your lease;

·management of the property, including ensuring tenancy conditions are fulfilled;

Your data is processed solely for the purpose of administering your lease or tenancy agreement, including supplying it to the third-party processors described under 4, below.This purpose does not require any further specific consent from you.

We operate a range of information and communication systems to enable our business to operate efficiently, on which your data may be stored and processed.These systems are subject to a high level of security and integrity.Data is stored on secure Cloud-based facilities.We also hold secure copies of our databases for back-up and business continuity purposes.

We will retain your data for as long as we have an ongoing legal relationship with you, including any period for which there are outstanding balances on your account, and for a period of six years after this in order to fulfil our statutory obligations.At the end of this period, we will review the necessity for retaining your personal data and all items that no longer need to be retained will be destroyed.We will repeat this review on an annual basis whilst we retain any of your personal data.

In the event that we sell the property that is subject to your lease, and in order to provide continuity of the management of your lease, we will supply your data to the new owner.

In each instance the amount of your personal data that is shared is the minimum needed to perform the necessary activity.These data processors will not use your information other than for the purpose for which we have supplied it to them, which is that set out under 3, above.They will not share your data with anyone else unless we instruct them to share it with others on the above list.

5.We do not transfer or store your data outside of the European Economic Area or outside the control of UK or EU regulations.

6.Besides the personal data that you have supplied to us, we may hold information on you obtained from the following sources:

·prior landlords (for example, where we have purchased the property subject to your lease);

·credit rating agencies;

·your bank, where you have made payments by credit transfer;

·your credit card company, where you have made payments using your credit card;

·publicly available sources, such as the Land Registry.

7.Your rights as a data subject are set out below, together with our commentary on how we address your rights in each case.

a.The right to be informed

Details of the ways in which we collect and use your personal data are set out under items 1-6, above.

b.The right of access

You have the right to access the personal data we hold on you.We will provide a copy of the personal data we hold as soon as is practicable and, in any case, within one month of your request.

c.The right to rectification

You have the right to require us to rectify inaccurate personal data, to complete it where it is incomplete or to correct it where it is misleading as to any matter of fact.

IWe will make the necessary adjustments as soon as is practicable and, in any case, within one month of your request.If, on review, we are satisfied that the personal data is accurate, we will notify you of this and of your rights to refer the matter to the the Information Commissioner.

d.The right to erasure

You have the right to request that your personal data is erased (the “right to be forgotten”).This right arises when the personal data is no longer necessary for the purpose for which it was collected and processed.As we hold your personal data solely for the fulfillment of the lease or tenancy agreement between us, this right will arise only following the end of your lease or tenancy agreement and will be subject to the retention requirements set out in paragraph 3, above.

e.The right to restrict processing

You have the right to request that that we restrict the processing of your personal data in the following circumstances:

·where you have contested the accuracy of your personal data;

·where we have unlawfully processed your data;

·where we no longer need your personal data, but you need us to keep (but not process) it in order to establish, exercise of defend a legal claim;

·where you have objected to our processing of your data and we are considering whether we have overriding legitimate grounds for doing so.

f.The right to data portability

You have the right to require us to provide a copy of the personal data that (a) you have supplied to us and (b) which we process by automatic means, to enable you to reuse it for your own purposes.We will respond to such requested by supplying the data in a commonly usable, structured form as soon as practicable and, in any case within one month of your request.If you request it, we will do our best to supply the data directly to another organisation that you authorise to receive it.

g.The right to object

You have the right to object to the processing of your data where:

·the basis for processing is the processor’s legitimate or performance of a task in the public interest, including profiling;

·the processing is for direct marketing, including profiling;

·the processing is for scientific/historical research and statistics.

We do not believe that any of these apply to our processing of your data.

h.Rights in relation to automated decision making and profiling

You have the right to object if you believe that your data is being processed in a manner involving automated decision making and personal profiling.We do not undertake any such activities.

For further information on the rights of data subject, visit the website of the Information Commissioner’s Office: https://ico.org.uk

To exercise any of the data subject rights described above, contact our managing agent using the following individual contact details that have been supplied to you.Please note that if you submit unreasonably repetitive requests, we have the right to charge a fee or refuse to respond.